CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1695 vulnerabilities reference this CWE, most recent first.
GHSA-74F5-7PJW-4CGF
Vulnerability from github – Published: 2022-05-14 01:37 – Updated: 2022-05-14 01:37In Traccar Server version 4.2, protocol/SpotProtocolDecoder.java might allow XXE attacks.
{
"affected": [],
"aliases": [
"CVE-2019-5748"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-01-09T17:29:00Z",
"severity": "CRITICAL"
},
"details": "In Traccar Server version 4.2, protocol/SpotProtocolDecoder.java might allow XXE attacks.",
"id": "GHSA-74f5-7pjw-4cgf",
"modified": "2022-05-14T01:37:57Z",
"published": "2022-05-14T01:37:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5748"
},
{
"type": "WEB",
"url": "https://github.com/traccar/traccar/commit/d7f6c53fd88635885914013649b6807ec53227bf"
},
{
"type": "WEB",
"url": "https://www.traccar.org/blog"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-74G4-5HCH-J7RM
Vulnerability from github – Published: 2022-05-24 19:09 – Updated: 2022-05-24 19:09XML External Entity vulnerability in Micro Focus Verastream Host Integrator, affecting version 7.8 Update 1 and earlier versions. The vulnerability could allow the control of web browser and hijacking user sessions.
{
"affected": [],
"aliases": [
"CVE-2021-22523"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-22T12:15:00Z",
"severity": "HIGH"
},
"details": "XML External Entity vulnerability in Micro Focus Verastream Host Integrator, affecting version 7.8 Update 1 and earlier versions. The vulnerability could allow the control of web browser and hijacking user sessions.",
"id": "GHSA-74g4-5hch-j7rm",
"modified": "2022-05-24T19:09:02Z",
"published": "2022-05-24T19:09:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22523"
},
{
"type": "WEB",
"url": "https://support.microfocus.com/kb/doc.php?id=7025169"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-756F-MJWR-H9X4
Vulnerability from github – Published: 2022-05-14 03:31 – Updated: 2022-05-14 03:31textpattern version version 4.6.2 contains a XML Injection vulnerability in Import XML feature that can result in Denial of service in context to the web server by exhausting server memory resources. This attack appear to be exploitable via Uploading a specially crafted XML file.
{
"affected": [],
"aliases": [
"CVE-2018-1000090"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-03-13T15:29:00Z",
"severity": "HIGH"
},
"details": "textpattern version version 4.6.2 contains a XML Injection vulnerability in Import XML feature that can result in Denial of service in context to the web server by exhausting server memory resources. This attack appear to be exploitable via Uploading a specially crafted XML file.",
"id": "GHSA-756f-mjwr-h9x4",
"modified": "2022-05-14T03:31:37Z",
"published": "2022-05-14T03:31:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000090"
},
{
"type": "WEB",
"url": "https://github.com/textpattern/textpattern/issues/1141"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7579-Q6RQ-WF6R
Vulnerability from github – Published: 2022-05-24 19:16 – Updated: 2022-05-24 19:16Apache OpenOffice has a dependency on expat software. Versions prior to 2.1.0 were subject to CVE-2013-0340 a "Billion Laughs" entity expansion denial of service attack and exploit via crafted XML files. ODF files consist of a set of XML files. All versions of Apache OpenOffice up to 4.1.10 are subject to this issue. expat in version 4.1.11 is patched.
{
"affected": [],
"aliases": [
"CVE-2021-40439"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-10-07T16:15:00Z",
"severity": "MODERATE"
},
"details": "Apache OpenOffice has a dependency on expat software. Versions prior to 2.1.0 were subject to CVE-2013-0340 a \"Billion Laughs\" entity expansion denial of service attack and exploit via crafted XML files. ODF files consist of a set of XML files. All versions of Apache OpenOffice up to 4.1.10 are subject to this issue. expat in version 4.1.11 is patched.",
"id": "GHSA-7579-q6rq-wf6r",
"modified": "2022-05-24T19:16:54Z",
"published": "2022-05-24T19:16:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40439"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r41eca5f4f09e74436cbb05dec450fc2bef37b5d3e966aa7cc5fada6d@%3Cannounce.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rfb2c193360436e230b85547e85a41bea0916916f96c501f5b6fc4702%40%3Cusers.openoffice.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rfb2c193360436e230b85547e85a41bea0916916f96c501f5b6fc4702@%3Cusers.openoffice.apache.org%3E"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/10/07/4"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-75P2-HGW4-G7F7
Vulnerability from github – Published: 2022-05-24 17:12 – Updated: 2023-09-26 20:43AutoUpdater.cs in AutoUpdater.NET before 1.5.8 allows XXE.
{
"affected": [
{
"package": {
"ecosystem": "NuGet",
"name": "Autoupdater.NET.Official"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-20627"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2023-07-18T22:29:18Z",
"nvd_published_at": "2020-03-23T17:15:00Z",
"severity": "CRITICAL"
},
"details": "AutoUpdater.cs in AutoUpdater.NET before 1.5.8 allows XXE.",
"id": "GHSA-75p2-hgw4-g7f7",
"modified": "2023-09-26T20:43:47Z",
"published": "2022-05-24T17:12:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20627"
},
{
"type": "WEB",
"url": "https://github.com/ravibpatel/AutoUpdater.NET/commit/1dc25f2bea6ea522dbac1512b5563c4746d539c3"
},
{
"type": "PACKAGE",
"url": "https://github.com/ravibpatel/AutoUpdater.NET"
},
{
"type": "WEB",
"url": "https://github.com/ravibpatel/AutoUpdater.NET/releases/tag/v1.5.8"
},
{
"type": "WEB",
"url": "https://www.doyler.net/security-not-included/autoupdater-net-vulnerability"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "AutoUpdater.NET allows XXE"
}
GHSA-75VW-3M5V-FPRH
Vulnerability from github – Published: 2022-01-21 23:43 – Updated: 2026-04-14 23:55corenlp is vulnerable to Improper Restriction of XML External Entity Reference
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.3.2"
},
"package": {
"ecosystem": "Maven",
"name": "edu.stanford.nlp:stanford-corenlp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.4.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-0239"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-01-19T15:02:11Z",
"nvd_published_at": "2022-01-17T07:15:00Z",
"severity": "CRITICAL"
},
"details": "corenlp is vulnerable to Improper Restriction of XML External Entity Reference",
"id": "GHSA-75vw-3m5v-fprh",
"modified": "2026-04-14T23:55:03Z",
"published": "2022-01-21T23:43:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0239"
},
{
"type": "WEB",
"url": "https://github.com/stanfordnlp/CoreNLP/pull/1242"
},
{
"type": "WEB",
"url": "https://github.com/stanfordnlp/CoreNLP/commit/f44e693882812b144e09d39850177ff0a1f8d16f"
},
{
"type": "WEB",
"url": "https://github.com/stanfordnlp/corenlp/commit/1940ffb938dc4f3f5bc5f2a2fd8b35aabbbae3dd"
},
{
"type": "PACKAGE",
"url": "https://github.com/stanfordnlp/corenlp"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/a717aec2-5646-4a5f-ade0-dadc25736ae3"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JAVA-EDUSTANFORDNLP-2342121"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "corenlp is vulnerable to Improper Restriction of XML External Entity Reference"
}
GHSA-763G-FQQ7-48WG
Vulnerability from github – Published: 2020-01-31 18:00 – Updated: 2021-08-19 16:49Due to an incomplete fix for CVE-2019-9658, checkstyle was still vulnerable to XML External Entity (XXE) Processing.
Impact
User: Build Maintainers
This vulnerability probably doesn't impact Maven/Gradle users as, in most cases, these builds are processing files that are trusted, or pre-vetted by a pull request reviewer before being run on internal CI infrastructure.
User: Static Analysis as a Service
If you operate a site/service that parses "untrusted" Checkstyle XML configuration files, you are vulnerable to this and should patch.
Note from the discoverer of the original CVE-2019-9658:
While looking at a few companies that run Checkstyle/PMD/ect... as a service I notice that it's a common pattern to run the static code analysis tool inside of a Docker container with the following flags:
--net=none \ --privileged=false \ --cap-drop=ALLRunning the analysis in Docker has the advantage that there should be no sensitive local file information that XXE can exfiltrate from the container. Additionally, these flags prevent vulnerabilities in static analysis tools like Checkstyle from being used to exfiltrate data via XXE or to perform SSRF. - Jonathan Leitschuh
Patches
Has the problem been patched? What versions should users upgrade to?
Patched, will be released with version 8.29 at 26 Jan 2020.
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
No workaround are available
References
- CWE-611: Improper Restriction of XML External Entity Reference
- GitHub Issue https://github.com/checkstyle/checkstyle/issues/7468
For more information
If you have any questions or comments about this advisory: * Open an issue in https://github.com/checkstyle/checkstyle/issues
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.puppycrawl.tools:checkstyle"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.29"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-10782"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2020-01-31T17:58:17Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "Due to an incomplete fix for [CVE-2019-9658](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9658), checkstyle was still vulnerable to XML External Entity (XXE) Processing.\n\n### Impact\n\n#### User: Build Maintainers\n\nThis vulnerability probably doesn\u0027t impact Maven/Gradle users as, in most cases, these builds are processing files that are trusted, or pre-vetted by a pull request reviewer before being run on internal CI infrastructure.\n\n#### User: Static Analysis as a Service\n\nIf you operate a site/service that parses \"untrusted\" Checkstyle XML configuration files, you are vulnerable to this and should patch.\n\nNote from the discoverer of the original CVE-2019-9658:\n\n\u003e While looking at a few companies that run Checkstyle/PMD/ect... as a service I notice that it\u0027s a common pattern to run the static code analysis tool inside of a Docker container with the following flags:\n\u003e ```\n\u003e --net=none \\\n\u003e --privileged=false \\\n\u003e --cap-drop=ALL\n\u003e ```\n\u003e Running the analysis in Docker has the advantage that there should be no sensitive local file information that XXE can exfiltrate from the container. Additionally, these flags prevent vulnerabilities in static analysis tools like Checkstyle from being used to exfiltrate data via XXE or to perform SSRF.\n\u003e \\- [Jonathan Leitschuh](https://twitter.com/jlleitschuh)\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nPatched, will be released with version 8.29 at 26 Jan 2020.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nNo workaround are available\n\n### References\n\n - [CWE-611: Improper Restriction of XML External Entity Reference](https://cwe.mitre.org/data/definitions/611.html)\n - GitHub Issue https://github.com/checkstyle/checkstyle/issues/7468\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in https://github.com/checkstyle/checkstyle/issues\n",
"id": "GHSA-763g-fqq7-48wg",
"modified": "2021-08-19T16:49:30Z",
"published": "2020-01-31T18:00:07Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/checkstyle/checkstyle/security/advisories/GHSA-763g-fqq7-48wg"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10782"
},
{
"type": "WEB",
"url": "https://github.com/checkstyle/checkstyle/issues/7468"
},
{
"type": "WEB",
"url": "https://github.com/checkstyle/checkstyle/commit/c46a16d177e6797895b195c288ae9a9a096254b8"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r8aaf4ee16bbaf6204731d4770d96ebb34b258cd79b491f9cdd7f2540@%3Ccommits.nifi.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00008.html"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JAVA-COMPUPPYCRAWLTOOLS-543266"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "XML external entity (XXE) processing (\u0027external-parameter-entities\u0027 feature was not fully disabled))"
}
GHSA-769G-XF8V-JX9V
Vulnerability from github – Published: 2022-05-24 19:19 – Updated: 2022-05-24 19:19An improper restriction of XML external entity reference vulnerability in the parser of XML responses of FortiPortal before 6.0.6 may allow an attacker who controls the producer of XML reports consumed by FortiPortal to trigger a denial of service or read arbitrary files from the underlying file system by means of specifically crafted XML documents.
{
"affected": [],
"aliases": [
"CVE-2021-36172"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-02T18:15:00Z",
"severity": "HIGH"
},
"details": "An improper restriction of XML external entity reference vulnerability in the parser of XML responses of FortiPortal before 6.0.6 may allow an attacker who controls the producer of XML reports consumed by FortiPortal to trigger a denial of service or read arbitrary files from the underlying file system by means of specifically crafted XML documents.",
"id": "GHSA-769g-xf8v-jx9v",
"modified": "2022-05-24T19:19:25Z",
"published": "2022-05-24T19:19:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36172"
},
{
"type": "WEB",
"url": "https://fortiguard.com/advisory/FG-IR-21-104"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-773M-X37X-96WR
Vulnerability from github – Published: 2024-11-29 12:31 – Updated: 2024-11-29 12:31A XML External Entity (XXE) vulnerability has been identified in Easy Tax Client Software 2023 1.2 and earlier across multiple platforms, including Windows, Linux, and macOS.
{
"affected": [],
"aliases": [
"CVE-2024-9044"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-29T08:15:05Z",
"severity": "MODERATE"
},
"details": "A XML External Entity (XXE) vulnerability has been identified in Easy Tax Client Software 2023 1.2 and earlier across multiple platforms, including Windows, Linux, and macOS.",
"id": "GHSA-773m-x37x-96wr",
"modified": "2024-11-29T12:31:49Z",
"published": "2024-11-29T12:31:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9044"
},
{
"type": "WEB",
"url": "https://www.ag.ch/de/verwaltung/dfr/steuern/natuerliche-personen/steuererklaerung-easytax"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:L/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-77CC-W3WM-6WHP
Vulnerability from github – Published: 2023-01-06 12:31 – Updated: 2023-01-12 23:42A vulnerability classified as problematic was found in e-Contract dssp up to 1.3.1. Affected by this vulnerability is the function checkSignResponse of the file dssp-client/src/main/java/be/e_contract/dssp/client/SignResponseVerifier.java. The manipulation leads to xml external entity reference. Upgrading to version 1.3.2 can address this issue. The name of the patch is ec4238349691ec66dd30b416ec6eaab02d722302. It is recommended to upgrade the affected component. The identifier VDB-217549 was assigned to this vulnerability.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "be.e_contract.dssp:dssp-client"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2016-15011"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2023-01-12T23:42:07Z",
"nvd_published_at": "2023-01-06T10:15:00Z",
"severity": "CRITICAL"
},
"details": "A vulnerability classified as problematic was found in e-Contract dssp up to 1.3.1. Affected by this vulnerability is the function `checkSignResponse` of the file `dssp-client/src/main/java/be/e_contract/dssp/client/SignResponseVerifier.java`. The manipulation leads to xml external entity reference. Upgrading to version 1.3.2 can address this issue. The name of the patch is ec4238349691ec66dd30b416ec6eaab02d722302. It is recommended to upgrade the affected component. The identifier VDB-217549 was assigned to this vulnerability.",
"id": "GHSA-77cc-w3wm-6whp",
"modified": "2023-01-12T23:42:07Z",
"published": "2023-01-06T12:31:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-15011"
},
{
"type": "WEB",
"url": "https://github.com/e-Contract/dssp/commit/ec4238349691ec66dd30b416ec6eaab02d722302"
},
{
"type": "PACKAGE",
"url": "https://github.com/e-Contract/dssp"
},
{
"type": "WEB",
"url": "https://github.com/e-Contract/dssp/releases/tag/dssp-1.3.2"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.217549"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.217549"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "dssp vulnerable to Improper Restriction of XML External Entity Reference"
}
Mitigation
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.